CVE-2026-84798: Missing Authorization in craftcms cms
Description
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.
CVSS v4.0
Score 7.1high
Affected software
craftcms
cms
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Craft CMS versions >= 5.0.0-RC1 and < 5.10.11, the ElementsController::actionDeleteForSite() method fails to perform an independent authorization check when deleting elements. The method only verifies deletion rights against the user's provisional draft, which checks draft ownership but not the user's permission to delete the canonical element. Consequently, users with viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacking deleteEntriesForSite permission can delete canonical site records or entire entries, including single-site entries, permanently and without recovery options.
Potential Impact
An authenticated user with limited permissions can irreversibly delete canonical entry site records or full entries, bypassing intended authorization controls. This can lead to permanent data loss since the deletions bypass the recycle bin recovery mechanism.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to prevent unauthorized deletion and monitor for suspicious deletion activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-02T10:19:06.331Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a980702acd9273b492a9199
Added to database: 09/02/2026, 11:22:42 UTC
Last enriched: 09/07/2026, 13:48:50 UTC
Last updated: 10/17/2026, 06:48:21 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.